Power trace analysis¶
This section summarizes the power analysis we performed in order to find appropriate glitch settings.
Using the power trace plotted above in combination with the source code in /hardware/victims/firmware/crypto/mbedtls/library/aes.c (specifically lines 719-773), we where able to detect the cycles in which the rounds start. We noted that the first 8 AES rounds are executed in a for loop, where each loop iteration performs 2 rounds. Then, the 9th and 10th rounds are executed outside of the loop. This is necessary because the 10th round differs from the rest. In every round, except the 10th, the MixColumns operation precedes the AddRoundKey operation. In the 10th round the MixColumns operations is omitted, resulting in a different power trace. In the following image, the start of two loop iterations are marked with a black line. Note that the the trace starts with an initialization, which lasts 76 cycles.
Extending this to the full power trace provides the following starting cycles:
| Operation |
Starting cycle |
| Initialization |
0 |
| Round 1,2 |
76 |
| Round 3,4 |
309 |
| Round 5,6 |
542 |
| Round 7,8 |
775 |
| Round 9,10 |
1008 |
Interestingly, the 2 rounds within one loop iteration generate a different power trace. This can be explained by the different parameters used in the even and odd rounds:
for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
{
AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
}
Nonetheless, given the operations performed are identical, we can assume that the second round in each loop iteration starts around halfway of our detected pattern. This means that, for example, round 8 starts at approximately cycle
775+(1008-775)/2 ~= 891.5
From the table we can see that the 2 round cycle count is 233 for each loop iteration.
This means that that, with our assumption, the second round in a loop iteration starts after around 233/2 = 116.5 cycles from the start of an iteration.
To confirm our analysis and assumption, we sliced the power trace and stacked the power traces of each set of two rounds. The result can be seen after executing the following code block.
